Description
A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. An attacker with low-privilege API access can leverage this endpoint to dump chassis-wide system health metrics, port performance violations, and configuration data without appropriate privileges.
Published: 2026-10-08
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

A missing authorization check in the Brocade Fabric OS REST API allows any authenticated user to retrieve complete Monitoring and Alerting Policy Suite data across all logical switches. This flaw enables a low‑privilege attacker to dump chassis‑wide system health metrics, port performance violations, and configuration details that should be protected. The vulnerability is a classic missing authorization (CWE‑862).

Affected Systems

Brocade Fabric OS versions earlier than 10.0.1 are affected. The security update addresses the flaw in Fabric OS 10.0.1.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. EPSS information is not available and the issue is not listed in CISA KEV. An authenticated attacker with any role can exploit the exposed endpoint over the network API; no additional access is required. The attack vector is inferred to be remote API access, but the description does not detail further exploitation steps.

Generated by OpenCVE AI on October 8, 2026 at 04:29 UTC.

Remediation

Vendor Solution

Security update is provided in Brocade Fabric OS 10.0.1

OpenCVE Recommended Actions

  • Apply the security update to Brocade Fabric OS 10.0.1 soon after release.
  • Restrict API access to only trusted management hosts and use network segmentation to isolate the Fabric OS controller.
  • Confirm that user roles are correctly defined and that no privileged API endpoints are exposed to lower‑privilege accounts.

Generated by OpenCVE AI on October 8, 2026 at 04:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 05:00:00 +0000

Type Values Removed Values Added
First Time appeared Brocade
Brocade fabric Os
Vendors & Products Brocade
Brocade fabric Os

Thu, 08 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
Title Missing Authorization Enables Full MAPS Violation Data Dump

Thu, 08 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Description A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. An attacker with low-privilege API access can leverage this endpoint to dump chassis-wide system health metrics, port performance violations, and configuration data without appropriate privileges.
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Brocade Fabric Os
cve-icon MITRE

Status: PUBLISHED

Assigner: brocade

Published:

Updated: 2026-10-08T02:48:37.410Z

Reserved: 2026-09-08T22:51:12.166Z

Link: CVE-2026-87669

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-08T03:16:36.237

Modified: 2026-10-08T03:16:36.237

Link: CVE-2026-87669

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T04:45:16Z

Weaknesses